Security · Last reviewed 22 August 2026

The less we hold,
the less there is
to steal.

Most of this page is a list of things we decided not to store. That is deliberate: it is cheaper and more honest than defending data we never needed.

What we hold
✓
Your email or phone number
One of them, as your sign-in
✓
Arrival events and charge logs
Site, time, outcome · 24-month retention
✓
Your vehicle model and plate
Plate is optional and encrypted at rest
What we do not hold
✗
Passwords
One-time codes and tokens, never a stored password
✗
Card or bank details
We are never a payment party
✗
Continuous location
Geofenced events only, matched on device
✗
Contacts, photos, other apps
Permissions never requested
Reporting a vulnerability
pgp on request
ack within 24 hours
triage within 5 working days
safe no legal action, ever

We do not run a bug bounty yet and will not pretend otherwise. We do credit reporters publicly, by name or handle, unless you ask us not to.

Incident history
No incidents to report.
This page exists so that sentence means something

When there is one, it appears here within 72 hours with what happened, what was accessed, and what we changed, before any press statement.

The basics, stated plainly

Transport and rest
TLS 1.3 in transit, encrypted at rest, secrets in a managed vault, never in the app bundle.
Access
Least privilege enforced in the database, hardware keys for staff, production access logged and reviewable.
Signing
Every request to the open network is Ed25519-signed, and every inbound callback is verified before it is trusted. Private keys never leave the vault.
Subprocessors
A small, contracted set for hosting, notifications and analytics, each gated by consent.

Funds we never hold

Voltu is not a wallet and not a payment aggregator. The driver pays the operator directly, over their own UPI app or over the open network with collected_by=bppso the operator collects the metered amount via a UPI mandate. There is no Voltu balance, no card storage, no float. It removes the heaviest compliance surface entirely, and it is literally true in the product copy (“we never held your money”).

Data residency

All application data lives in India (Supabase, Mumbai ap-south-1). Any payment-adjacent data stays in India per RBI expectations. Map tiles, glyphs and station data are self-hosted, so we can apply India’s official boundaries per the National Geospatial Policy rather than depend on a foreign map that mis-depicts them.

DPDP & consent

Aligned to the Digital Personal Data Protection Act, 2023: consent is granular and purpose-limited (location, arrival telemetry, analytics and marketing are separate asks, each revocable), tracked in a consent ledger. Data-principal rights (access, correction, erasure) are exercisable in-app, a privacy notice is published, and a grievance officer is named. Transactional and marketing communications are separated and honour their own consent.

Data minimisation

The reliability layer needs one fact: did a driver arrive and did it work. Arrival telemetry is geofenced to within ~120 m of a known charge point, records only a site id, a timestamp and a yes/no, and where else you drove is matched on-device and discarded. Crowd reports carry no reporter identity when read back. Nothing is sold, ever.

Least privilege

  • Row-Level Security on every table. A user reaches only their own rows; cross-user access is denied by policy, not by convention.
  • The service-role key is server-only: never in the app bundle or the browser. Public web forms use the anon key with insert-only policies, so nothing can be read back.
  • Every input is validated against a shared schema; the server, not the client, decides auth and geo-verification.
  • Secrets live in EAS Secrets / Supabase Vault, never in git; queries are parameterised.

Signed rails

Trust artefacts are cryptographically signed with Ed25519. Our Beckn/UEI buyer-app signs every outbound request, and verifies every inbound callbackagainst the partner’s registered key over the raw body before it is trusted; unverified callbacks are dropped. Private keys stay in the Vault; only public keys are ever registered with the network.

App & transport

  • TLS 1.3 in transit; certificate pinning on the mobile client.
  • Platform attestation (Play Integrity / App Attest) to keep automated abuse off the network.
  • Short-lived tokens in secure device storage; biometric app-lock available.
  • CI runs dependency and static analysis; type-checking gates every merge.

Anti-abuse (the crowd is the moat, so it’s defended)

A single report never moves a public grade. A success rate is withheld until at least three graded reports earn it. Reports are server-side geo-verified (a report filed at the charger counts double; one filed from afar counts less), rate-limited per user, and weighted so an operator cannot upvote its own dead charger. Corrections are one-vote-per-driver-per-kind and are surfaced as counts, never auto-applied by a single actor.

CERT-In & incidents

Operations are built to the CERT-In 2022 directions: cyber-incident reporting within six hours, logs retained 180 days in India, synchronised clocks, and an independent VAPT before public launch. Observability (crash, performance, release health) is wired from day one, with PII and location masked and gated behind analytics consent.